tolelom
b0de89a18a
- 체인 nonce 경쟁 조건 수정 (operatorMu + per-user mutex) - 등록/SSAFY 원자적 트랜잭션 (wallet+profile 롤백 보장) - IdempotencyRequired 미들웨어 (SETNX 원자적 클레임) - 런치 티켓 API (JWT URL 노출 방지) - HttpOnly 쿠키 refresh token - SSAFY OAuth state 파라미터 (CSRF 방지) - Refresh 시 DB 조회로 최신 role 사용 - 공지사항/유저목록 페이지네이션 - BodyLimit 미들웨어 (1MB, upload 제외) - 입력 검증 강화 (닉네임, 게임데이터, 공지 길이) - 에러 메시지 내부 정보 노출 방지 - io.LimitReader (RPC 10MB, SSAFY 1MB) - RequestID 비출력 문자 제거 - 단위 테스트 (auth 11, announcement 9, bossraid 16) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
114 lines
3.3 KiB
Go
114 lines
3.3 KiB
Go
package config
|
|
|
|
import (
|
|
"log"
|
|
"os"
|
|
"strconv"
|
|
|
|
"github.com/joho/godotenv"
|
|
)
|
|
|
|
type Config struct {
|
|
AppPort string
|
|
DBHost string
|
|
DBPort string
|
|
DBUser string
|
|
DBPassword string
|
|
DBName string
|
|
RedisAddr string
|
|
RedisPassword string
|
|
JWTSecret string
|
|
RefreshSecret string
|
|
JWTExpiryHours int
|
|
AdminUsername string
|
|
AdminPassword string
|
|
BaseURL string
|
|
GameDir string
|
|
|
|
// Chain integration
|
|
ChainNodeURL string
|
|
ChainID string
|
|
OperatorKeyHex string
|
|
WalletEncryptionKey string
|
|
|
|
// Server-to-server auth
|
|
InternalAPIKey string
|
|
|
|
// SSAFY OAuth 2.0
|
|
SSAFYClientID string
|
|
SSAFYClientSecret string
|
|
SSAFYRedirectURI string
|
|
}
|
|
|
|
var C Config
|
|
|
|
func Load() {
|
|
_ = godotenv.Load()
|
|
|
|
hours, _ := strconv.Atoi(getEnv("JWT_EXPIRY_HOURS", "24"))
|
|
C = Config{
|
|
AppPort: getEnv("APP_PORT", "8080"),
|
|
DBHost: getEnv("DB_HOST", "localhost"),
|
|
DBPort: getEnv("DB_PORT", "3306"),
|
|
DBUser: getEnv("DB_USER", "root"),
|
|
DBPassword: getEnv("DB_PASSWORD", ""),
|
|
DBName: getEnv("DB_NAME", "a301"),
|
|
RedisAddr: getEnv("REDIS_ADDR", "localhost:6379"),
|
|
RedisPassword: getEnv("REDIS_PASSWORD", ""),
|
|
JWTSecret: getEnv("JWT_SECRET", "secret"),
|
|
RefreshSecret: getEnv("REFRESH_SECRET", "refresh-secret"),
|
|
JWTExpiryHours: hours,
|
|
AdminUsername: getEnv("ADMIN_USERNAME", "admin"),
|
|
AdminPassword: getEnv("ADMIN_PASSWORD", "admin1234"),
|
|
BaseURL: getEnv("BASE_URL", "http://localhost:8080"),
|
|
GameDir: getEnv("GAME_DIR", "/data/game"),
|
|
|
|
ChainNodeURL: getEnv("CHAIN_NODE_URL", "http://localhost:8545"),
|
|
ChainID: getEnv("CHAIN_ID", "tolchain-dev"),
|
|
OperatorKeyHex: getEnv("OPERATOR_KEY_HEX", ""),
|
|
WalletEncryptionKey: getEnv("WALLET_ENCRYPTION_KEY", ""),
|
|
|
|
InternalAPIKey: getEnv("INTERNAL_API_KEY", ""),
|
|
|
|
SSAFYClientID: getEnv("SSAFY_CLIENT_ID", ""),
|
|
SSAFYClientSecret: getEnv("SSAFY_CLIENT_SECRET", ""),
|
|
SSAFYRedirectURI: getEnv("SSAFY_REDIRECT_URI", ""),
|
|
}
|
|
}
|
|
|
|
// WarnInsecureDefaults logs warnings for security-sensitive settings left at defaults.
|
|
// In production mode (APP_ENV=production), insecure defaults cause a fatal exit.
|
|
func WarnInsecureDefaults() {
|
|
isProd := getEnv("APP_ENV", "") == "production"
|
|
|
|
insecure := false
|
|
if C.JWTSecret == "secret" {
|
|
log.Println("WARNING: JWT_SECRET is using the default value — set a strong secret for production")
|
|
insecure = true
|
|
}
|
|
if C.RefreshSecret == "refresh-secret" {
|
|
log.Println("WARNING: REFRESH_SECRET is using the default value — set a strong secret for production")
|
|
insecure = true
|
|
}
|
|
if C.AdminPassword == "admin1234" {
|
|
log.Println("WARNING: ADMIN_PASSWORD is using the default value — change it for production")
|
|
insecure = true
|
|
}
|
|
if C.WalletEncryptionKey == "" {
|
|
log.Println("WARNING: WALLET_ENCRYPTION_KEY is empty — blockchain wallet features will fail")
|
|
}
|
|
|
|
if isProd && insecure {
|
|
log.Fatal("FATAL: insecure default secrets detected in production — set JWT_SECRET, REFRESH_SECRET, and ADMIN_PASSWORD")
|
|
}
|
|
}
|
|
|
|
// getEnv returns the environment variable value, or fallback if unset or empty.
|
|
// Note: explicitly setting a variable to "" is treated as unset.
|
|
func getEnv(key, fallback string) string {
|
|
if v := os.Getenv(key); v != "" {
|
|
return v
|
|
}
|
|
return fallback
|
|
}
|